Closed Test Privacy Notice
Who runs this
The operator is Matthew Bravo, an individual in Alaska, United States, acting personally for a non-commercial project. Contact: the email address in your invitation. Requests are answered within 30 days.
What is kept
| Data | From | Why | Who sees it |
|---|---|---|---|
| Email address | You, or Google / Discord when you sign in with them | Your account; sign-in, confirmation and reset emails; the tester invitation list | You and the operator |
| Password (one-way hash only) | You, if you use email + password | Signing in | Nobody |
| Google or Discord account id, name, picture | The provider, with your permission | Creating and signing in to your account | Name and picture are public if you keep them as your display name and avatar |
| Username, display name, avatar | You | Labelling your boards | Public: anyone can see the list of usernames and display names |
| Watch statuses, ratings, tier boards | You | The product | Only you; your individual ratings are never shown to others |
| Average rating per title | Computed from everyone's ratings | Community score | Public, as an average and a count |
| Shared boards | You, when you click Share or Copy link | Showing your board to people you send the link to | Anyone who has the link; it can be copied or screenshotted by them |
| Episode reminder settings: on or off, which Watching shows, estimated weeks, show names in alerts | You, only if you turn reminders on | Showing reminders inside RANKAI (the bell) for shows you watch | Only you; kept inside your list |
| Browser alerts: not switched on yet. When they are, and only if you turn them on for a device: that device's push-service address and your browser's encryption keys for it | Your browser | Sending reminder alerts to that device | Only RANKAI's reminder job. Your browser maker's push service (Google, Mozilla, Apple or Microsoft) carries the alert but cannot read it: alerts are encrypted end to end. By default an alert doesn't name the show. |
| Reminder log, for browser alerts only: which alerts were sent and when | RANKAI's reminder job | Avoiding duplicate alerts. A rare failure at the moment of sending can still cause one repeat. | You (in Download my data) and the operator |
| Your agreement to the test terms (version and time) | You, when you tick the box | Record of agreement | You and the operator |
| Sign-in times and method | The sign-in service | Security | The operator |
| IP address, browser type, pages requested | Automatically, by the hosting and database services | Delivering the site, preventing abuse | Those services and the operator, for their standard log periods |
Not collected: date of birth, phone number, payment details, location, contacts, analytics or advertising data.
Where it is kept
Accounts and data are stored by Supabase on Amazon Web Services in Ohio, United States. The site files are served by Netlify. One JavaScript library is loaded from jsDelivr, which sees your IP address when it is fetched. Signing in with Google or Discord tells that provider you used RANKAI. Fonts and images come from RANKAI itself. Once browser alerts are available and you turn them on, each alert passes, encrypted, through your browser maker's push service. Encrypted backup copies are kept by the operator (see "How long"). No one else receives your data.
Cookies and browser storage
RANKAI sets no cookies. It keeps three things in your browser's local storage: your last tab and filters (rankai-ui-v3), a copy of your list while you are signed out (rankai-v3, cleared when you sign out of an account), and your sign-in session (sb-…-auth-token, removed when you sign out). Once browser alerts are available and you turn them on, your browser also installs RANKAI's small alert helper (a service worker); it stores nothing about you and only displays alerts. Clearing site data removes all of them. Nothing tracks you across other sites.
How long
Until you delete your account, or until the test ends, when all test accounts are deleted after notice on the site.
Backups. The operator makes encrypted backup copies of the database by hand from time to time (there is no fixed schedule yet). They are kept on the operator's computer and in the operator's personal cloud storage, encrypted with a passphrase kept separately. Each new backup removes backups more than 14 days old; if no new backup is made, an older copy stays until the next one is. The cloud storage service may keep deleted files in its own history for a period it sets.
When you delete your account, your data is removed from the live database at once. Copies inside backups made before that stay until those backups are removed as described above; they are not used for anything else. If a backup ever has to be restored, the site stays closed until accounts deleted since that backup are removed again, using the deletion records kept with the data. One gap remains: if the live database itself were lost, a deletion made after the newest backup might not be on record; tell the operator and that account will be removed.
Your choices
- Profile → Download my data: a file with everything RANKAI holds about you.
- Profile → change your display name or username.
- Reminders (the bell): turn reminders or single shows off at any time. Once browser alerts are available, you can turn them off the same way, and signing out also stops them on that device. An alert already handed to your browser's push service just before you change a setting can still arrive.
- Profile → Delete my account: removes your account, list, ratings, profile, shared boards, reminder settings, alert registrations and reminder log at once. Links you shared stop working; copies others made are not affected. If you cannot sign in, email the operator from the address on the account.
Children
The test is for people 13 and over. If the operator learns an account belongs to someone under 13, it is deleted.
Security
Connections are encrypted. Passwords are stored only as hashes. Database rules stop any other person, signed in or not, from reading or changing your rows. If a security incident affects your information, the operator will tell you and the relevant authorities as the law requires.
Changes
If this notice changes in a way that matters during the test, you will be asked to acknowledge the new version the next time you sign in.